AZ-400 Practice Test 34 — 15 Questions

Question 1

You have a multi-stage YAML pipeline that builds and deploys a Node.js application. You want to ensure that the build stage runs only when changes are made to the 'src' folder. Which trigger configuration should you use?

Accepted Answer

Trigger with 'paths' filter. Option A is correct because the path trigger filters changes to specific paths. Option B is wrong because it would trigger on any change. Option C is wrong because batch changes the number of triggers but not the path. Option D is wrong because branches filter by branch, not path.

Answer

Trigger with 'batch' set to true

Answer

Trigger with 'branches' filter

Answer

Disable CI trigger and use a scheduled trigger

Question 2

Your build pipeline uses a hosted agent. You need to securely pass a connection string to a deployment task. The connection string contains a password. What is the recommended approach to store and use this secret in Azure Pipelines?

Accepted Answer

Define the connection string as a secret variable in the pipeline's variable group or in the pipeline settings UI, and reference it as `$(connectionString)`.. Option B is correct because Azure Pipelines secret variables are encrypted and not exposed in logs. Option A is wrong because storing secrets in YAML variables directly exposes them. Option C is wrong because Azure Key Vault is more complex for simple secrets and requires additional permissions. Option D is wrong because environment variables in the agent are visible to other processes.

Answer

Define the connection string as a plain variable in the YAML pipeline.

Answer

Hardcode the connection string in the deployment script and set the file as read-only.

Answer

Store the connection string in Azure Key Vault and use the 'Azure Key Vault' task to retrieve it at runtime.

Question 3

Which TWO actions should you take to implement a CI/CD pipeline for a microservices application using Azure Pipelines? (Choose two.)

Accepted Answer

Publish build artifacts and use them in the release stages.. Options B and D are correct. B: Using a multi-stage YAML pipeline allows you to define build, test, and deploy stages in a single file. D: Publishing build artifacts and using them in release stages ensures consistency between build and deploy. Option A is wrong because using separate pipelines for each microservice would increase complexity; you can use a single pipeline with matrix strategies. Option C is wrong because you should not store credentials in YAML; use variable groups or Azure Key Vault. Option E is wrong because Azure Pipelines supports YAML for both CI and CD.

Answer

Use a classic release pipeline instead of YAML for the deployment stages.

Answer

Store deployment credentials directly in the YAML file.

Answer

Create a separate pipeline for each microservice.

Question 4

You are configuring a release pipeline in Azure Pipelines for a Java application. The pipeline must run integration tests after deployment to a test environment and only proceed to production if tests pass. Which THREE should you configure?

Accepted Answer

Use a pipeline condition on the production stage to run only if the test stage succeeded.. Option A, Option C, and Option D are correct. A gate with Azure Monitor or Application Insights checks test results. A post-deployment approval ensures manual sign-off. A condition on the production stage evaluates the test outcome. Option B is wrong because the task should not be skipped. Option E is wrong because the agent job runs on the agent, not in the environment.

Answer

Set the agent job to run on the environment itself.

Answer

Set the integration test step to run only if the previous build succeeded.

Question 5

You need to integrate security scanning into your build pipeline to detect vulnerable open-source dependencies. Which Azure DevOps extension should you use?

Accepted Answer

WhiteSource Bolt. Option A is correct because WhiteSource Bolt (Mend) is a popular extension for open-source vulnerability scanning. Option B is wrong because SonarQube is for code quality, not dependency scanning. Option C is wrong because Azure Policy is for compliance of Azure resources. Option D is wrong because GitHub Advanced Security is for GitHub repos, not Azure Repos.

Answer

Azure Policy

Answer

GitHub Advanced Security

Answer

SonarQube

Question 6

Your team uses a multi-stage YAML pipeline in Azure Pipelines. The pipeline includes a stage that runs integration tests against a test environment. You want to ensure that the integration tests are not affected by other pipelines that deploy to the same environment concurrently. What should you implement?

Accepted Answer

Set the environment's 'Exclusive lock' check to enabled.. Option C is correct because exclusive lock check ensures only one pipeline runs at a time for a given environment. Option A is incorrect because manual approval does not prevent concurrency. Option B is incorrect because environment checks only evaluate conditions, not concurrency. Option D is incorrect because deployment queue settings with 'Number of parallel deployments' set to 1 provide exclusive lock, but the correct answer is exclusive lock resourced by environment.

Answer

Set the pipeline's 'Maximum number of parallel deployments' to 1.

Answer

Configure a required template check on the environment.

Answer

Add a manual approval check on the environment.

Question 7

Which THREE options are valid strategies for implementing progressive exposure in Azure Pipelines?

Accepted Answer

Ring-based deployment.. Options A, C, and D are correct. Canary, blue-green, and ring-based deployments are all progressive exposure strategies. Option B is not progressive exposure; it's a deployment method. Option E is a deployment strategy but not typically progressive exposure.

Answer

Rolling update.

Answer

Immutable infrastructure.

Question 8

You have a pipeline that builds a Docker image and pushes it to Azure Container Registry. You need to ensure that only the latest successful build image is tagged as 'latest'. Which tagging strategy should you use?

Accepted Answer

Use a conditional step that runs only when the build succeeds to tag the image as 'latest'. Option A is correct because tagging only on successful builds ensures 'latest' reflects the last successful image. Option B is wrong because tagging all images with 'latest' would overwrite even failed builds. Option C is wrong because it does not ensure success. Option D is wrong because it tags all images, not just successful ones.

Answer

Use the build ID as the tag and manually update 'latest'

Answer

Use the Git commit hash as the tag and push 'latest' separately

Answer

Always tag the image as 'latest' regardless of build status

Question 9

Your team uses Azure Pipelines to build a .NET application. You notice that the build takes 15 minutes because of dependency restoration. You want to cache the NuGet packages to speed up subsequent builds. Which task should you add to your pipeline?

Accepted Answer

Cache task with a key based on the package lock file. Option A is correct because the 'Cache' task is used to cache dependencies including NuGet packages. Option B is wrong because 'NuGet restore' does not cache across builds. Option C is wrong because 'DownloadBuildArtifacts' is for downloading artifacts, not caching. Option D is wrong because 'DotNetCoreCLI' with 'restore' does not provide caching across builds.

Answer

DownloadBuildArtifacts task

Answer

NuGet restore task with the 'noCache' option set to false

Answer

DotNetCoreCLI task with the 'restore' command

Question 10

Refer to the exhibit. You are reviewing an ARM template used in an Azure Pipeline deployment. Which security concern should you address?

Accepted Answer

The admin password is hardcoded in the template. Option B is correct because the admin password is hardcoded in plain text, which is a security vulnerability. Option A is wrong because the param default is acceptable. Option C is wrong because API version is valid. Option D is wrong because VM size is fine.

Answer

The VM size is too small for production

Answer

The apiVersion is outdated

Answer

The location parameter has a default value

Question 11

You are creating a release pipeline that uses Azure Pipelines to deploy to multiple virtual machines. You need to ensure that the deployment runs on each machine in parallel. Which deployment strategy should you use?

Accepted Answer

Run once deployment with parallel execution. Option D is correct because the 'runOnce' strategy with 'parallel' deployment option runs the job on multiple targets simultaneously. Option A is wrong because rolling strategy updates a subset at a time. Option B is wrong because canary is a phased rollout. Option C is wrong because blue-green swaps between environments.

Answer

Blue-green deployment

Answer

Canary deployment

Answer

Rolling deployment

Question 12

The exhibit shows a deployment job in an Azure Pipelines YAML file. The deployment fails with the error 'No package found with pattern: $(Pipeline.Workspace)/drop/*.zip'. What is the most likely cause?

Accepted Answer

The artifact is not downloaded to the expected path; the artifact name must be included in the path.. Option C is correct because the 'download: current' step downloads the artifact from the current pipeline run, but the artifact path usually includes the artifact name as a subfolder. The correct path would be '$(Pipeline.Workspace)/drop' or '$(Pipeline.Workspace)/drop/**/*.zip'. Option A is wrong because the service connection is unrelated to the artifact. Option B is wrong because the wildcard is valid. Option D is wrong because the agent type does not affect artifact download behavior.

Answer

The wildcard pattern '*.zip' is not supported.

Answer

The Azure service connection has expired.

Answer

The pipeline is using a Microsoft-hosted agent that does not support the download task.

Question 13

Refer to the exhibit. You have an Azure Pipelines YAML file for a .NET Core application. The pipeline is triggered on changes to the main branch, but only for files under src/. After a push to main that modifies a file in src/, the pipeline does not start. What is the most likely reason?

Accepted Answer

The path filter 'src/*' does not match files in subdirectories of src/.. Option B is correct because the trigger has a path filter with include but no exclude, which is correct, but the indentation of 'paths' is wrong (it should be at the same level as 'branch')? Actually the exhibit shows correct indentation. Another common issue: The trigger definition is inside an array, but the YAML might be parsed incorrectly. Actually the root cause is that the pipeline is defined as a multi-stage YAML but the trigger is configured at the top level; however, the exhibit shows the trigger correctly. The real issue: The trigger path filter 'include' pattern 'src/*' does not recursively match files in subdirectories. Azure Pipelines path filters require '**' for recursive matches. So the pipeline does not trigger because 'src/*' only matches files directly in src/, not in subfolders. Option A is wrong because the syntax is valid. Option C is wrong because the branch is main. Option D is wrong because the build configuration variable does not affect triggers.

Answer

The branch filter is missing the 'refs/heads/' prefix.

Answer

The trigger configuration has a syntax error: 'include' should be 'includes'.

Answer

The variable 'buildConfiguration' is not defined at the top level.

Question 14

Your team uses Azure Pipelines to build a React application. The build process runs npm install, npm test, and npm run build. The build succeeds, but the application loads slowly in the browser due to large bundle sizes. What should you add to the pipeline to optimize the build?

Accepted Answer

Add a step to run Webpack bundle analyzer and implement code splitting.. Option C is correct because the Webpack task can be configured to analyze bundle size and split code. Option A is wrong because caching dependencies does not reduce bundle size. Option B is wrong because minification is likely already done. Option D is wrong because unit tests do not affect bundle size.

Answer

Add a step to cache the node_modules folder.

Answer

Add a step to minify JavaScript using Terser.

Answer

Add a step to run additional unit tests to catch performance issues.

Question 15

Your team uses GitHub for source control and wants to set up continuous integration using GitHub Actions. Which file should you create in the repository to define the workflow?

Accepted Answer

.github/workflows/ci.yml. Option A is correct because GitHub Actions workflows are defined in YAML files under the .github/workflows directory. Option B is wrong because azure-pipelines.yml is for Azure Pipelines. Option C is wrong because the Dockerfile is for building Docker images. Option D is wrong because Jenkinsfile is for Jenkins.

Answer

Jenkinsfile

Answer

Dockerfile

Answer

azure-pipelines.yml